I am currently running a query that is quite inefficient, and it fails when run for extended periods.
Splunk only allows me to run it every 15 minutes, which is a limitation I have as a work around for now.
Unfortunately, I can't improve the situation because I don't have control over the log creation process as the logs come from a third party system
Currently, I'm running the query as an alert every 15 minutes, but I'd like to capture these metrics over a more extended period, such as 24 hours or more.
Is there a built-in mechanism in Splunk that can store and append the results of these queries for future reference?
I am aware that I could use the Java SDK to extract and aggregate the metrics outside of Splunk, but that approach is not ideal.
